CVE-2015-7318

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/09/22/16Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1264796Issue Tracking, Patch, Third Party Advisory
https://plone.org/security/hotfix/20150910Patch, Vendor Advisory
https://plone.org/security/hotfix/20150910/header-injectionVendor Advisory
http://www.openwall.com/lists/oss-security/2015/09/22/16Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1264796Issue Tracking, Patch, Third Party Advisory
https://plone.org/security/hotfix/20150910Patch, Vendor Advisory
https://plone.org/security/hotfix/20150910/header-injectionVendor Advisory

Timeline

Published: Sep 25, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-73197.5SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 fo CVE-2015-73204.3Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calenda CVE-2015-73225.0The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and CVE-2015-73233.5The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and CVE-2015-73246.1Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 fo CVE-2015-73269.8XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3.CVE-2015-73274.3Mozilla Firefox before 41.0 does not properly restrict the availability of High Resolution Time API times, which allows remote attackers to CVE-2015-73284.7Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private ke CVE-2015-73308.8Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet co CVE-2015-73316.6The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --s CVE-2015-73337.8MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported CVE-2015-73347.8MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported